CVE-2026-97446 in Linux
Summary
by MITRE • 09/24/2026
In the Linux kernel, the following vulnerability has been resolved:
ACPICA: Fix NULL pointer dereference in acpi_ns_custom_package()
acpi_ns_custom_package() unconditionally dereferences the first element of the package to read the _BIX version number, without checking for NULL:
if ((*Elements)->Common.Type != ACPI_TYPE_INTEGER)
When firmware returns a _BIX package whose first element is an unresolvable reference, ACPICA evaluates that entry to NULL. acpi_ns_remove_null_elements() does not strip NULL entries for ACPI_PTYPE_CUSTOM packages (fixed-position format would break if elements were shifted), so acpi_ns_custom_package() sees the NULL and causes a crash.
Add a NULL check for the first element (version field) before dereferencing it. The caller then receives AE_AML_OPERAND_TYPE instead of crashing.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/24/2026
The vulnerability identified in the Linux kernel involves a critical null pointer dereference within the Advanced Configuration and Power Interface Component Architecture ACPICA subsystem, specifically located in the acpi_ns_custom_package function. This flaw arises from an assumption that firmware-provided ACPI tables will always contain valid data structures at expected memory locations without validation. The specific issue occurs when processing _BIX package objects which are used to report battery information including version numbers and status fields. During evaluation of these packages, if the first element is defined as a reference object pointing to an unresolvable target within the ACPI namespace, the interpreter resolves this reference to NULL rather than raising an immediate error or returning a placeholder value.
The root cause lies in the lack of defensive programming practices regarding pointer validation before memory access operations. The acpi_ns_custom_package function attempts to read the _BIX version number by directly dereferencing the first element of the package array using the expression (*Elements)->Common.Type without performing any preliminary checks for NULL pointers. This unconditional dereference assumes that all elements in custom packages are valid ACPI objects, ignoring scenarios where firmware bugs or malformed tables result in unresolved references being passed into this routine. The subsequent comparison against ACPI_TYPE_INTEGER triggers a kernel panic due to accessing invalid memory addresses associated with the null pointer.
The operational impact of this vulnerability is severe as it leads to system instability and potential denial of service conditions on affected systems. When triggered, the NULL pointer dereference causes an immediate crash in kernel space resulting in a stack trace dump and potentially requiring a hard reset or reboot depending on the configured panic behavior settings such as kernel.panic sysctl parameters. This affects reliability especially during boot sequences or runtime power management operations where battery information is queried frequently. Systems relying on accurate ACPI data for thermal management, charging control, or emergency shutdown procedures may experience unpredictable behavior if this crash occurs before critical subsystems initialize properly.
From a classification perspective this vulnerability aligns with CWE-476 which describes NULL pointer dereference issues commonly found in systems programming languages like C where manual memory management is required and input validation is often overlooked. In the context of attack vectors it represents an opportunity for local denial of service attacks if an attacker can influence firmware contents through physical access or compromised BIOS updates although exploitation typically requires specific hardware configurations with malformed ACPI tables rather than remote code execution capabilities directly from this single flaw alone.
Mitigation strategies primarily involve applying vendor-provided kernel patches that include the necessary NULL checks before dereferencing pointer elements within acpi_ns_custom_package. The fix ensures that if the first element is NULL the function returns an appropriate error code such as AE_AML_OPERAND_TYPE instead of proceeding with unsafe memory access operations. Administrators should ensure their systems are updated to versions containing this patch and consider validating ACPI tables using tools like iasl or custom scripts during firmware development cycles to detect malformed structures early in the supply chain process before deployment into production environments.